Booz Allen Hamilton Holding Corp

Previous wording

•risks relating to our relationships with the U.S. government;

Current wording

•risks relating to our relationships and reputation with the U.S. government;

Previous wording

•changes in U.S. government spending and mission priorities, including due to uncertainty relating to funding of the U.S. government and increasing the debt ceiling;

Current wording

•changes in U.S. government spending and mission priorities, including due to uncertainty relating to the new presidential administration, funding of the U.S. government, and increasing the debt ceiling;

Previous wording

•risks related to inflation that could impact the cost of doing business and/or reduce customer buying power;

Current wording

•risks related to inflation and new or increased tariffs that could impact the cost of doing business and/or reduce customer buying power;

Previous wording

•internal system or service failures and security breaches, including, but not limited to, those resulting from external or internal threats, including cyber attacks on our network and internal systems;

Current wording

•internal system or service failures and security breaches, including, but not limited to, those resulting from external or internal threats, including cyber attacks on our network and internal systems, or on our customers’ network or internal systems;

Previous wording

•risks related to the use of artificial intelligence, which include potential liability as well as regulatory, competition, reputational and other risks;

Current wording

•risks related to the development and use of artificial intelligence, which include potential liability as well as regulatory, competition, reputational and other risks;

Previous wording

•misconduct or other improper activities from our employees, subcontractors, or suppliers, including the improper access, use, or release of our or our clients’ sensitive or classified information;

Current wording

•misconduct or other improper activities from our employees, subcontractors, or suppliers, including the improper access, use, or release of our or our customers’ sensitive or classified information;

Previous wording

•failure to maintain strong relationships with other contractors, or the failure of contractors with which we have entered into a sub- or prime-contractor relationship to meet their obligations to us or our clients;

Current wording

•failure to maintain strong relationships with other contractors, or the failure of contractors with which we have entered into a sub- or prime-contractor relationship to meet their obligations to us or our customers;

Previous wording

•risks related to changes to our operating structure, capabilities, or strategy intended to address client needs, grow our business, or respond to market developments; and

Current wording

•risks related to changes to our operating structure, capabilities, or strategy intended to address customer needs, grow our business, or respond to market developments; and

Previous wording

•the timing and amount of our dividends, if any; and

Current wording

•the timing and amount of our dividends, if any.

Previous wording

We depend on contracts with U.S. government agencies for substantially all of our revenue. If our relationships with such agencies are harmed, our future revenue and operating profits would decline.

Current wording

We depend on contracts with U.S. government agencies for substantially all of our revenue. If our reputation or relationships with such agencies are harmed, our future revenue and operating profits would decline.

Previous wording

The U.S. government is our primary client, with revenue from contracts and task orders, either as a prime or a subcontractor, with U.S. government agencies accounting for 98% of our revenue for fiscal year 2024. Our belief is that the successful future growth of our business will continue to depend primarily on our ability to be awarded work under U.S. government contracts, as we expect this will be the primary source of substantially all of our revenue in the foreseeable future. For this reason, any issue that compromises our relationship with the U.S. government generally or any U.S. government agency that we serve would cause our revenue to decline. Among the key factors in maintaining our relationship with U.S. government agencies is our performance on contracts and task orders, the strength of our professional reputation, compliance with applicable laws and regulations, and the strength of our relationships with client personnel. In addition, the mishandling or the perception of mishandling of sensitive information, such as our failure to maintain the confidentiality of the existence of our business relationships with certain of our clients, including as a result of misconduct or other improper activities by our employees, subcontractors, or suppliers, or a failure to maintain adequate protection against security breaches, including those resulting from cyber attacks, could harm our relationship with U.S. government agencies. See “—Our employees or subcontractors may engage in misconduct or other improper activities, which could harm our ability to conduct business with the U.S. government.” Our relationship with the U.S. government could also be damaged as a result of an agency’s dissatisfaction with work performed by us, a subcontractor, or other third parties who provide services or products for a specific project for any reason, including due to perceived or actual deficiencies in the performance or quality of our work, and we may incur additional costs to address any such situation and the profitability of that work might be impaired. Further, negative publicity concerning government contractors in general, or us, regardless of accuracy, may harm our reputation among federal agencies and federal government contractors. Due to the sensitive nature of our work and our confidentiality obligations to our customers, we may be unable or limited in our ability to respond to such negative publicity, which could also harm our reputation and business. To the extent our reputation or relationships with U.S. government agencies is impaired, our revenue and operating profits could materially decline.

Current wording

Our relationship with U.S. government agencies could be harmed by the mishandling or the perception of mishandling of sensitive information, such as our failure to maintain the confidentiality of the existence of our business relationships with certain of our customers, including as a result of misconduct or other improper activities by our employees, subcontractors, or suppliers, or a failure to maintain adequate protection against security breaches, including those resulting from cyber attacks. See “—Our employees or subcontractors may engage in misconduct or other improper activities, which could harm our ability to conduct business with the U.S. government.” Our relationship with the U.S. government could also be damaged as a result of an agency’s dissatisfaction with work performed by us, a subcontractor, or other third parties who provide services or products for a specific project for any reason, including due to perceived or actual deficiencies in the performance or quality of our work, and we may incur additional costs to address any such situation and the profitability of that work might be impaired. In addition, to the extent our performance under a contract does not meet a U.S. government agency’s expectations, the customer might seek to terminate the contract prior to its scheduled expiration date, provide a negative assessment of our performance to government-maintained contractor past-performance data repositories, fail to award us additional business under existing contracts or otherwise, and direct future business to our competitors.

Previous wording

Our business depends upon continued U.S. government expenditures on defense, intelligence, and civil programs for which we provide support. These expenditures have not remained constant over time, have been reduced in certain periods, and have been affected by the U.S. government’s efforts to improve efficiency and reduce costs affecting U.S. government programs generally. Our business, prospects, financial condition, or operating results could be materially harmed by, among other causes, the following:

Current wording

Our business depends upon continued U.S. government expenditures on defense, intelligence, and civil programs for which we provide support. These expenditures have not remained constant over time, have been and in the future may be reduced in certain periods, and have been and in the future may be affected by the U.S. government’s efforts to improve efficiency and reduce costs affecting U.S. government programs generally. Our business, prospects, financial condition, or operating results could be materially harmed by, among other causes, the following:

Previous wording

•changes or delays in U.S. government programs that we support or related requirements;

Current wording

•changes or delays in U.S. government programs that we support or related requirements, including shifts in the scope of work that we support and delays in procurements;

Previous wording

In addition, any disruption in the functioning of U.S. government agencies, including as a result of U.S. government closures and shutdowns, terrorism, war, international conflicts (including the ongoing conflict between Russia and Ukraine and the ongoing conflict between Israel and Hamas), natural disasters, public health crises, destruction of U.S. government facilities, and other potential calamities could have a negative impact on our operations and cause us to lose revenue or incur additional costs due to, among other things, our inability to deploy our staff to client locations or facilities as a result of such disruptions.

Current wording

In addition, any disruption in the functioning of U.S. government agencies, including as a result of U.S. government closures and shutdowns, terrorism, war, international conflicts (including the ongoing conflict between Russia and Ukraine, ongoing conflicts in the Middle East, and increased tensions in Asia), trade tensions related to recent shifts in international trade policies, natural disasters, public health crises, destruction of U.S. government facilities, and other potential calamities could have a negative impact on our operations and cause us to lose revenue or incur additional costs due to, among other things, our inability to deploy our staff to customer locations or facilities as a result of such disruptions.

Previous wording

The U.S. government budget deficits, the national debt, and prevailing economic conditions, and actions taken to address them, could negatively affect U.S. government expenditures on defense, intelligence, and civil programs for which we provide support. The Department of Defense is one of our significant clients and cost cutting, including through consolidation and elimination of duplicative organizations and insourcing, has become a major initiative for the Department of Defense. A reduction in the amount of, or delays or cancellations of funding for, services that we are contracted to provide as a result of any of these related initiatives, legislation, or otherwise could have a material adverse effect on our business and results of operations. In addition, government agencies have reduced management support services spending in recent years. If federal awards for management support services continue to decline, our revenue and operating profits may materially decline and could have a material and adverse effect on our business and results of operations.

Current wording

The U.S. government budget deficits, the national debt, and prevailing economic conditions, and actions taken to address them, could negatively affect U.S. government expenditures on defense, intelligence, and civil programs for which we provide support. A reduction in the amount of, or delays or cancellations of funding for, services that we are contracted to provide as a result of initiatives with certain U.S. government departments, legislation, or otherwise could have a material adverse effect on our business and results of operations. Further, there is ongoing uncertainty regarding how the U.S. Congress will address the legal limit on U.S. debt commonly known as the debt ceiling, and for which the U.S. Treasury has announced that it has been using extraordinary measures to prevent the U.S. government's default on its payment obligations, and to extend the time that the U.S. Congress has to raise its statutory debt limit or otherwise resolve the funding situation. If the debt ceiling is not raised, the U.S. government may not be able to fulfill its funding obligations and there could be significant disruption to all discretionary programs, which would have material adverse impacts on us and our industry.

Previous wording

These or other factors could cause our defense, intelligence, or civil clients to decrease the number of new contracts awarded generally and fail to award us new contracts, reduce their purchases under our existing contracts, exercise their right to terminate our contracts, or not exercise options to renew our contracts, any of which could cause a material decline in our revenue.

Current wording

These or other factors could cause our defense, intelligence, or civil customers to decrease the number of new contracts awarded generally and fail to award us new contracts, reduce their purchases under our existing contracts, exercise their right to terminate our contracts, or not exercise options to renew our contracts, any of which could cause a material decline in our revenue.

Previous wording

We have seen our current competitive environment result in an increase in the number of bid protests from unsuccessful bidders on new program awards. It can take many months for the relevant U.S. government agency to resolve protests by one or more of our competitors of contract awards we receive. Bid protests may result in significant expense to us, contract modification, or loss of an awarded contract as a result of the award being overturned. Even where we do not lose the awarded contract, the resulting delay in the startup and funding of the work under these contracts may cause our actual results to differ materially and adversely from those anticipated.

Current wording

We have seen our current competitive environment result in delays in procurements generally as well as an increase in the number of bid protests from unsuccessful bidders on new program awards. It can take many months for the relevant U.S. government agency to resolve protests by one or more of our competitors of contract awards we receive. Bid protests may result in significant expense to us, contract modification, or loss of an awarded contract as a result of the award being overturned. Even where we do not lose the awarded contract, the resulting delay in the startup and funding of the work under these contracts may cause our actual results to differ materially and adversely from those anticipated. There can be no assurance that these delays will not ultimately have a material adverse impact on our business and financial performance.

Previous wording

We believe that one of the key elements of our success is our position as the holder of 2,650 active task orders under IDIQ contract vehicles as of March 31, 2024.

Current wording

We believe that one of the key elements of our success is our position as the holder of 2,596 active task orders under IDIQ contract vehicles as of March 31, 2025.

Previous wording

IDIQ contracts provide for the issuance by the client of orders for services or products under the contract, and often contain multi-year terms and unfunded ceiling amounts, which allow but do not commit the U.S. government to purchase products and services from contractors. Our ability to generate revenue under each of these types of contracts depends upon our ability to be awarded task orders for specific services by the client. IDIQ contracts may be awarded to one contractor (single award) or several contractors (multiple award). Multiple contractors must compete under multiple award IDIQ contracts for task orders to provide particular services, and contractors earn revenue only to the extent that they successfully compete for these task orders. A failure to be awarded task orders under such contracts would have a material adverse effect on our results of operations and financial condition.

Current wording

IDIQ contracts provide for the issuance by the customer of orders for services or products under the contract, and often contain multi-year terms and unfunded ceiling amounts, which allow but do not commit the U.S. government to purchase products and services from contractors. Our ability to generate revenue under each of these types of contracts depends upon our ability to be awarded task orders for specific services by the customer. IDIQ contracts may be awarded to one contractor (single award) or several contractors (multiple award). Multiple contractors must compete under multiple award IDIQ contracts for task orders to provide particular services, and contractors earn revenue only to the extent that they successfully compete for these task orders. A failure to be awarded task orders under such contracts would have a material adverse effect on our results of operations and financial condition.

Previous wording

Under fixed-price contracts, we perform specific tasks for a predetermined price. Compared to time-and-materials and cost-reimbursable contracts, fixed-price contracts generally offer higher margin opportunities because we receive the benefits of any cost savings, but involve greater financial risk because we bear the impact of any cost overruns. The U.S. government has generally indicated that it intends to increase its use of fixed price contract procurements. Because we assume the risk for cost overruns and contingent losses on fixed-price contracts, an increase in the percentage of fixed-price contracts in our contract mix would increase our risk of suffering losses.

Current wording

Under fixed-price contracts, we perform specific tasks or deliver a specific outcome for a predetermined price. Compared to time-and-materials and cost-reimbursable contracts, fixed-price contracts generally offer higher margin opportunities because we receive the benefits of any cost savings, but involve greater financial risk because we bear the impact of any cost overruns. The U.S. government has generally indicated that it intends to increase its use of fixed price contract procurements. We have seen a recent preference for the use of fixed price contracts with the new presidential administration, which may result in future contract modifications and conversions of existing contracts to fixed-price contracts. Because we assume the risk for cost overruns and contingent losses on fixed-price contracts, an increase in the percentage of fixed-price contracts in our contract mix would increase our risk of suffering losses.

Previous wording

Our backlog does not include contracts that have been awarded but are currently under protest and also does not include any task orders under IDIQ contracts, except to the extent that task orders have been awarded to us under those contracts. For additional disclosure regarding our backlog, please see “Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations—Factors and Trends Affecting Our Results of Operations—Sources of Revenue—Contract Backlog.”

Current wording

Our backlog does not include contracts that have been awarded but are currently under protest and also does not include any task orders under IDIQ contracts, GSA Schedule or other master agreement contract vehicles, except to the extent that task orders have been awarded to us under those contracts. For additional disclosure regarding our backlog, please see “Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations—Factors and Trends Affecting Our Results of Operations—Sources of Revenue—Contract Backlog.”

Previous wording

We historically have not realized all of the revenue included in our total backlog, and we may not realize all of the revenue included in our current or future total backlog. There is a higher degree of risk in this regard with respect to unfunded backlog and priced options. In addition, there can be no assurance that our backlog will result in actual revenue in any particular period. This is because the actual receipt, timing, and amount of revenue under contracts included in backlog are subject to various contingencies, including congressional appropriations, many of which are beyond our control. The actual receipt of revenue from contracts included in backlog may never occur or may be delayed because: a program schedule could change or the program could be canceled; a contract’s funding or scope could be reduced, modified, delayed, de-obligated, or terminated early, including as a result of a lack of appropriated funds or cost cutting initiatives and other efforts to reduce U.S. government spending and/or the automatic federal defense spending cuts required by sequestration; in the case of funded backlog, the period of performance for the contract has expired or the U.S. government has exercised its unilateral right to cancel multi-year contracts and related orders or terminate existing contracts for convenience or default; in the case of unfunded backlog, funding may not be available; or, in the case of priced options, our clients may not exercise their options. In addition, client staff headcount growth is the primary means by which we are able to recognize revenue growth. Any inability to hire additional appropriately qualified personnel or failure to timely and effectively deploy such additional personnel against funded backlog could negatively affect our ability to grow our revenue. We may also not recognize revenue on funded backlog due to, among other reasons, the tardy submissions of invoices by our subcontractors and the expiration of the relevant appropriated funding in accordance with a predetermined expiration date such as the end of the U.S. government's fiscal year. The amount of our funded backlog is also subject to change, due to, among other factors: changes in congressional appropriations that reflect changes in U.S. government policies or priorities resulting from various military, political, economic, or international developments; changes in the use of U.S. government contracting vehicles, and the provisions therein used to procure our services; and adjustments to the scope of services under, or cancellation of contracts, by the U.S. government at any time. Furthermore, even if our backlog results in revenue, the contracts may not be profitable.

Current wording

We historically have not realized all of the revenue included in our total backlog, and we may not realize all of the revenue included in our current or future total backlog. There is a higher degree of risk in this regard with respect to unfunded backlog and priced options. In addition, there can be no assurance that our backlog will result in actual revenue in any particular period. This is because the actual receipt, timing, and amount of revenue under contracts included in backlog are subject to various contingencies, including congressional appropriations, many of which are beyond our control. The actual receipt of revenue from contracts included in backlog may never occur or may be delayed because: a program schedule could change or the program could be canceled; a contract’s funding or scope could be reduced, modified, delayed, de-obligated, or terminated early, including as a result of a lack of appropriated funds or cost cutting initiatives and other efforts to reduce U.S. government spending and/or the automatic federal defense spending cuts required by sequestration; in the case of funded backlog, the period of performance for the contract has expired or the U.S. government has exercised its unilateral right to cancel multi-year contracts and related orders or terminate existing contracts for convenience or default; in the case of unfunded backlog, funding may not be available; or, in the case of priced options, our customers may not exercise their options.

Previous wording

Systems that we develop, integrate, maintain, or otherwise support could experience security breaches which may damage our reputation with our clients and hinder future contract win rates.

Current wording

Systems that we develop, integrate, maintain, or otherwise support could experience security breaches which may damage our reputation with our customers and hinder future contract win rates.

Previous wording

We develop, integrate, maintain, or otherwise support systems and provide services that include managing and protecting information involved in intelligence, national security, and other sensitive government functions. Our systems also store and process sensitive Company and commercial client information, including personally identifiable, health and financial information. The cybersecurity threats we and our clients face have grown more frequent and sophisticated, including but not limited to bad actors looking to augment traditional cyber tools and tradecraft with artificial intelligence capabilities that increase the speed, scale, and intricacy of threats. A security breach, including from insider threats, could result in the exfiltration of our or our clients’ data and has the potential to do serious harm to our business, damage our reputation, prevent us from executing further work on sensitive systems for U.S. government or commercial clients, and/or hinder future contract win rates. Damage to our reputation or limitations on our eligibility for additional work or any liability resulting from a security breach in one of the systems we develop, install, maintain, or otherwise support could have a material adverse effect on our results of operations.

Current wording

We develop, integrate, maintain, or otherwise support systems and provide services that include managing and protecting information involved in intelligence, national security, and other sensitive government functions. Our systems also store, process, and transmit sensitive Company and government and commercial customer information, including personally identifiable, health and financial information. The cybersecurity threats we, our customers, and third parties face have grown more frequent and sophisticated, including but not limited to bad actors looking to augment traditional cyber tools and tradecraft with artificial intelligence capabilities that increase the speed, scale, and intricacy of threats, which may not be recognized until after they have been launched. A security breach, including from insider threats, could result in the exfiltration of our or our customers’ data and has the potential to do serious harm to our business, damage our reputation, prevent us from executing further work on sensitive systems for U.S. government or commercial customers, hinder future contract win rates, and/or cause us to incur significant expense to respond to and remediate the breach. Damage to our reputation or limitations on our eligibility for additional work or any liability resulting from a security breach in one of the systems we develop, install, maintain, or otherwise support could have a material adverse effect on our results of operations.

Previous wording

Certain services we provide and technologies we develop are designed to detect and monitor threats to our clients and may expose our staff to financial loss or physical or reputational harm.

Current wording

Certain services we provide and technologies we develop are designed to prevent, detect and monitor threats to our customers and may expose us or our customers and business partners to financial loss or physical or reputational harm.

Previous wording

We help our clients detect, monitor and mitigate threats to their people, information, and facilities. These threats may originate from nation states, terrorists or criminal actors, activist hackers or others who seek to harm our clients. Successful attacks on our clients may cause reputational harm to us and our clients, as well as liability to our clients or third parties. In addition, if we are associated with our clients in this regard, our staff, systems, information, and facilities may be targeted by a similar group of threat actors and may be at risk for financial loss, or physical or reputational harm.

Current wording

We help our customers prevent, detect, monitor and mitigate threats to their people, information, and facilities. These threats may originate from nation states, terrorists or criminal actors, activist hackers, financially or politically motivated actors, or others who seek to harm our customers. Successful attacks on our customers may cause reputational harm to us and our customers and business partners, as well as liability to our customers or third parties. If we are associated with our customers and business partners in this regard, our staff, systems, information, and facilities may be targeted by a similar group of threat actors and may be at risk for financial loss or physical or reputational harm.

Previous wording

Internal system or service failures, or those of our vendors, including as a result of cyber or other security threats, could disrupt our business and impair our ability to effectively provide our services to our clients, which could damage our reputation and have a material adverse effect on our business and results of operations.

Current wording

Internal system or service failures, or those of our vendors, including as a result of cyber or other security threats, could disrupt our business and impair our ability to effectively provide our services to our customers, which could damage our reputation and have a material adverse effect on our business and results of operations.

Previous wording

We create, implement, integrate, and maintain information technology (“IT”) systems that (a) are often mission critical, (b) regularly involve sensitive information, (c) may be deployed within war zones or other hazardous environments, and/or (d) can include information whose confidentiality is protected by law or contract. Additionally, we maintain internal systems housing sensitive employee and confidential company data. As a result, our systems and IT work products are susceptible to systems or service failures resulting from technical complexity, failures of third-party service providers, natural disasters, power shortages, insider threats (including improper access to the Company’s, clients’ or third parties’ information or resources, employee error, or malfeasance), terrorist attacks, physical or electronic security breaches, cyber attacks, computer viruses, or similar events or disruptions. Our systems and IT work product are the target of constantly evolving cyber attack vectors, including malware, social engineering, denial-of-service attacks, malicious software programs, phishing, account takeovers, and other cyber attacks fueled by emerging technologies, such as artificial intelligence. We have noticed an increase in the frequency and sophistication of the cyber and security threats these systems face, with attacks that are more advanced and persistent, targeting us because, as a defense services contractor, we hold classified, controlled unclassified, and other sensitive information. As a result, we and our vendors face a heightened risk of a security breach or disruption resulting from an attack by computer hackers, persons with access to systems inside our organization, foreign governments, and cyber terrorists.

Current wording

We create, implement, integrate, and maintain information technology (“IT”) systems that (a) are often mission critical, (b) regularly involve sensitive information, (c) may be deployed within war zones or other hazardous environments, and/or (d) can include information whose confidentiality is protected by law or contract. Additionally, we maintain internal systems housing sensitive employee and confidential company data. As a result, our systems and IT work products are susceptible to systems or service failures resulting from technical complexity, failures of third-party service providers, natural disasters, power shortages, insider threats (including improper access to the Company’s, customers’ or third parties’ information or resources, employee error, or malfeasance), terrorist attacks, physical or electronic security breaches, cyber attacks, computer viruses, or similar events or disruptions. Our systems and IT work product are the target of constantly evolving cyber attack vectors, including malware, social engineering, denial-of-service attacks, malicious software programs, phishing, smishing, vishing, identity spoofing (including through the use of emerging technologies such as “deep fakes”), account takeovers, and other cyber attacks fueled by emerging technologies, such as artificial intelligence. We have observed an increase in the frequency and sophistication of the cyber and security threats these systems face, with attacks that are more advanced and persistent, targeting us because we hold classified, controlled unclassified, and other sensitive information. As a result, we and our vendors face a heightened risk of a security breach or disruption resulting from an attack by computer hackers, persons with access to systems inside our organization, foreign governments, and cyber terrorists.

Previous wording

We have put in place policies, controls, and technologies to help detect and protect against such attacks, but we cannot guarantee that future incidents will not occur. If an incident occurs, we may not be able to successfully mitigate the impact. We have been the target of these types of attacks in the past, and attempted attacks are likely to continue. Due to the ongoing geopolitical conflicts in Europe and the Middle East, and increased tensions in Asia, state-sponsored parties or their supporters may launch retaliatory cyber attacks, and may attempt to conduct other geopolitically motivated retaliatory actions. Those same parties may also attempt to fraudulently induce employees or authorized third parties, including contractors, to disclose sensitive information in order to gain access to our systems or data, or that of our clients, customers, or service providers. If successful, these types of attacks on our network or other systems or service failures could have a material adverse effect on our business and results of operations, due to, among other things, the loss of client or proprietary data, interruptions or delays in our clients' businesses, or damage to our reputation. In addition, the failure or disruption of our systems, communications, vendors, or utilities could cause us to interrupt or suspend our operations, which could have a material adverse effect on our business and results of operations. If our employees, contractors, suppliers or other authorized third parties do not adhere (whether inadvertently or intentionally) to appropriate information security protocols, our protocols are inadequate, or our or our clients' sensitive information is released and/or compromised, we may experience significant negative impacts to our reputation and expose us or our clients to liability. We are not immune from the possibility of a malicious insider compromising our information systems and infrastructure, including but not limited to insiders exfiltrating the personal data of employees and clients, stealing corporate trade secrets and key financial metrics, and illegally diverting funds. No series of measures can fully safeguard against every insider threat. Refer to “Item 1C. Cybersecurity” for additional information about our cybersecurity risk management program.

Current wording

We have put in place policies, controls, and technologies to help detect and protect against such attacks, but we cannot guarantee that future incidents will not occur. If an incident occurs, we may not be able to successfully mitigate the impact. We have been the target of these types of attacks in the past, and attempted attacks are likely to continue. Due to the ongoing geopolitical conflicts in Europe and the Middle East, and increased tensions in Asia, state-sponsored parties or their supporters may launch retaliatory cyber attacks, and may attempt to conduct other geopolitically motivated retaliatory actions. Those same parties may also attempt to fraudulently induce employees or authorized third parties, including contractors, to disclose sensitive information in order to gain access to our systems or data, or that of our customers, or service providers. If successful, these types of attacks on our network or other systems or service failures could have a material adverse effect on our business and results of operations, due to, among other things, the loss of customer or proprietary data, interruptions or delays in our customers' businesses, or damage to our reputation. In addition, the failure or disruption of our systems, communications, vendors, or utilities could cause us to interrupt or suspend our operations, which could have a material adverse effect on our business and results of operations. If our employees, contractors, suppliers or other authorized third parties do not adhere (whether inadvertently or intentionally) to appropriate information security protocols, our protocols are inadequate, or our or our customers' sensitive information is released and/or compromised, we may experience significant negative impacts to our reputation and expose us or our customers to liability. We are not immune from the possibility of a malicious insider compromising our information systems and infrastructure, including but not limited to insiders exfiltrating the personal data of employees and customers, stealing corporate trade secrets and key financial metrics, illegally diverting funds, or intentionally disclosing our secrets (e.g., application credentials) to others in order to bypass our security policies and control mechanisms. No series of measures can fully safeguard against every insider threat. Refer to “Item 1C. Cybersecurity” for additional information about our cybersecurity risk management program.

Previous wording

If our or our vendors' systems, services, or other applications have significant defects, errors, or vulnerabilities, are successfully attacked by cyber and other security threats, suffer delivery delays, or otherwise fail to meet our clients’ expectations, we may:

Current wording

If our or our vendors' systems, services, or other applications have significant defects, errors, or vulnerabilities, are successfully attacked by cyber and other security threats, suffer delivery delays, or otherwise fail to meet our customers’ expectations, we may:

Previous wording

•lose revenue due to adverse client reaction;

Current wording

•lose revenue due to adverse customer reaction;

Previous wording

•be required to provide additional services to a client at no charge;

Current wording

•be required to provide additional services to a customer at no charge;

Previous wording

•lose revenue due to the deployment of employees for remediation efforts instead of client assignments;

Current wording

•lose revenue due to the deployment of employees for remediation efforts instead of customer assignments;

Previous wording

•receive negative publicity, which could damage our reputation and credibility of our brand and adversely affect our ability to attract or retain clients or talent;

Current wording

•receive negative publicity, which could damage our reputation and credibility of our brand and adversely affect our ability to attract or retain customers or talent;

Previous wording

•be unable to successfully market services that are reliant on the creation and maintenance of secure information technology systems to U.S. government, international, and commercial clients;

Current wording

•be unable to successfully market services that are reliant on the creation and maintenance of secure information technology systems to U.S. government, international, and commercial customers;

Previous wording

•suffer claims by clients, employees, or impacted third parties for substantial damages, particularly as a result of any successful network or systems breach and exfiltration of client and/or third-party information; or

Current wording

•suffer claims by customers, employees, or impacted third parties for substantial damages, particularly as a result of any successful network or systems breach and exfiltration of customer and/or third-party information;

Previous wording

In addition to any costs resulting from contract performance or required corrective action, these failures may result in increased costs or loss of revenue if they result in clients postponing subsequently scheduled work or canceling or failing to renew contracts.

Current wording

In addition, we may have insufficient recourse against our vendors for costs, losses or claims we incur as a result of or reliance on their systems, services or other applications having significant defects, errors, or vulnerabilities, or which are successfully attacked by cyber and other security threats, resulting in our inability to meet our customers’ expectations. Further, in addition to any costs resulting from contract performance or required corrective action, these failures may result in increased costs or loss of revenue if they result in customers postponing subsequently scheduled work or canceling or failing to renew contracts.

Previous wording

The costs related to cyber or other security threats or disruptions may not be fully insured or indemnified by other means. Additionally, some cyber technologies and techniques that we utilize or develop may raise potential liabilities related to legal compliance, intellectual property, and civil liberties, including privacy concerns, which may not be fully insured or indemnified. We may not be able to obtain and maintain insurance coverage on reasonable terms or in sufficient amounts to cover one or more large claims, or the insurer may disclaim coverage as to some types of future claims. The successful assertion of any large claim against us could seriously harm our business. Even if not successful, these claims could result in significant legal and other costs, may be a distraction to our management, may harm our client relationships, and may adversely affect our ability to attract or retain talent. In certain new business areas, we may not be able to obtain sufficient insurance and may decide not to accept or solicit business in these areas.

Current wording

The costs related to cyber or other security threats or disruptions may not be fully insured or indemnified by other means. Additionally, some cyber technologies and techniques that we utilize or develop may raise potential liabilities related to legal compliance, intellectual property, and civil liberties, including privacy concerns, which may not be fully insured or indemnified. We may not be able to obtain and maintain insurance coverage on reasonable terms or in sufficient amounts to cover one or more large claims, or the insurer may disclaim coverage as to some types of future claims. The successful assertion of any large claim against us could seriously harm our business. Even if not successful, these claims could result in significant legal and other costs, may be a distraction to our management, may harm our customer relationships, and may adversely affect our ability to attract or retain talent. In certain new business areas, we may not be able to obtain sufficient insurance and may decide not to accept or solicit business in these areas.

Previous wording

Any failure by us, our vendors or other business partners to comply with international, U.S. federal, state or local laws and regulations regarding data privacy or cybersecurity could result in regulatory actions or lawsuits against us, legal liability, injunctions, fines, damages or other costs. We may also incur substantial expenses in implementing and maintaining compliance with such laws and regulations, including those that require certain types of data to be retained on servers within these jurisdictions. In addition, enactment or expansion of laws related to the use of artificial intelligence in our operations could increase the cost of doing business, subject us to potential liability, regulatory risk or reputational harm. Our failure to comply with applicable laws and regulations may result in privacy claims or enforcement actions against us, including liabilities, fines and damage to our reputation, any of which may have a material adverse effect on our results of operations.

Current wording

Any failure by us, our vendors or other business partners to comply with international, U.S. federal, state or local laws and regulations regarding data privacy, including the protection of personal or confidential information of our customers or employees which we may handle and process, or cybersecurity could result in significant monetary damages, regulatory enforcement actions, fines, penalties, private litigation or claims, and/or criminal prosecution in one or more jurisdictions, including as a result of the perception of our practices, products, and services in relation to violations of individual privacy, data protection rights, or cybersecurity requirements. We may also incur substantial expenses in implementing and maintaining compliance with such laws and regulations, or anticipated laws and regulations, including those that require certain types of data to be retained on servers within these jurisdictions. These laws and regulations, and anticipated laws and regulations, are increasing in complexity and number, change frequently, sometimes conflict or create different requirements across jurisdictions, and are subject to interpretation by different regulators and courts, creating the possibility of different compliance measures or enforcement risks across jurisdictions, which may cause additional expenses for compliance with such laws and regulations. Our failure to comply with applicable laws and regulations may result in privacy claims or enforcement actions against us, including liabilities, fines and damage to our reputation, any of which may have a material adverse effect on our results of operations.

Previous wording

The U.S. Congress is considering federal privacy, cybersecurity and AI legislation that would create requirements similar to or possibly exceeding these comprehensive U.S. state privacy laws on a 50-state basis. Any federal legislation may or may not preempt the comprehensive U.S. state privacy laws, creating the possibility of different compliance measures or enforcement risks nationally or on a per-state basis. Any obligations that may be imposed on us under any of the comprehensive U.S. state privacy laws or similar laws may be different from or in addition to those required by the EU GDPR, UK GDPR, and any other applicable international laws, which may cause additional expense for compliance across jurisdictions. The EU GDPR, UK GDPR, other international laws, and the laws of U.S. states also impose obligations to maintain and implement an information security program that includes administrative, technical, physical, or organizational safeguards, as well as obligations to give notice to affected individuals and to certain regulators in the event of a data breach. We may be required to spend significant resources to comply with these information security and data breach legal requirements. A significant data breach (including various forms of external attack, such as ransomware, as well as data incidents resulting from internal actions or omissions) could have negative consequences for our business and future prospects, including possible penalties, fines, damages, reduced customer demand, legal claims against and by clients, personnel, business partners or other persons claiming to be affected, harm to our systems and operations and harm to our reputation and brand.

Current wording

For example, the European Union’s General Data Protection Regulation (the “GDPR”), and the United Kingdom’s GDPR impose compliance obligations on companies that process personal data of people in the European Union and United Kingdom, respectively. In the U.S., numerous federal, state, and local data privacy laws and regulations govern the collection, use, and processing of personal information, provide rights to residents of those respective states, in some cases including personal information collected from residents in the context of recruitment and employment, as well as business-to-business arrangements. Compliance with these laws, or emerging international, U.S. federal, state or local privacy laws, requires investments into compliance programs, investments to deploy, operate and maintain technology that enables compliance, potential modifications to business processes, ongoing data protection activities and documentation requirements, and creates the potential for fines, individual claims and other liabilities for noncompliance as well as litigation risks, particularly in the event of a data breach, and could have a material adverse effect on our business, including how we use personal information or our results of operations. Certain international, U.S. federal, state laws and regulations also impose obligations to maintain and implement an information security program that includes administrative, technical, physical, or organizational safeguards, as well as obligations to give notice to affected individuals and to certain regulators in the event of a data breach. We may be required to spend significant resources to comply with these information security and data breach legal requirements. A significant data breach (including various forms of external attack, such as ransomware, as well as data incidents resulting from internal actions or omissions) could have negative consequences for our business and future prospects, including possible penalties, fines, damages, reduced customer demand, legal claims against and by customers, personnel, business partners or other persons claiming to be affected, harm to our systems and operations and harm to our reputation and brand.